weblogchecker 0.1.0

First release of weblogchecker, the access-log companion to phpscan.

What it does: streams Apache/nginx access logs you own (plain, .gz, or stdin) and reports compromise indicators - webshell interactions (c99/r57/FilesMan/b374k/WSO), the eval-stdin.php UnitTest shell from the October 2026 php2shell wave, executables answering inside upload directories, POSTs to static files, URI exploitation patterns, scanner user-agents, and wp-login/xmlrpc brute-force bursts including a possible-success pattern. Every finding carries severity, confidence, the raw log lines as evidence, and remediation. Exit codes: 0 clean / 1 indicators / 2 usage error.

Honesty rules: indicators are leads, not proof of compromise; failed attempts stay LOW; a bundled fixture of a normal busy WordPress day is asserted in tests to produce zero findings.

Install (PyPI pending publisher setup):
pip install git+https://github.com/PHPatch/weblogchecker.git
or use the signed artifacts below. Verify with pgp-key.asc - PHPatch Security, fingerprint BAA1 586A AD37 18C0 CE41 D288 FE23 A624 54E3 5307.

Stdlib only. No network. Read-only. MIT.